Secrecy around police surveillance equipment proves a case’s undoing

TALLAHASSEE, Florida (WP-BLOOM) — The case against Tadrae McKenzie looked like an easy win for prosecutors.

He and two buddies robbed a small-time pot dealer of US$130 worth of weed using a BB gun. Under Florida law, that was robbery with a deadly weapon, with a sentence of at least four years in prison.

But before trial, his defence team detected investigators’ use of a secret surveillance tool, one that raises significant privacy concerns.

In an unprecedented move, a state judge ordered the police to show the device — a cell-tower simulator sometimes called a StingRay — to the attorneys.

Rather than show the equipment, the state offered McKenzie a plea bargain.

Today, 20-year-old McKenzie is serving six months’ probation after pleading guilty to a second-degree misdemeanor. He got, as one civil liberties advocate said, the deal of the century.

McKenzie’s case is emblematic of the growing, but hidden, use of a sophisticated surveillance technology borrowed from the national security world for use by local law enforcement.

It shows how a gag order imposed by the FBI — on grounds that discussing the device’s operation will compromise its effectiveness — has left judges, the public and criminal defendants in the dark on how the tool works.

That secrecy in turn has hindered debate over whether the StingRay’s use respects Americans’ civil liberties.

The StingRay is a box about the size of a small suitcase — there’s also a handheld version — that simulates a cellphone tower. It elicits signals from all mobile phones in its vicinity. That means it collects information not just about a criminal suspect’s communications, but about the communications of potentially hundreds of law-abiding citizens.

The Tallahassee police have used the StingRay or a similar device in 250 investigations over a six-year period from mid-2007 through early 2014, according to a list of cases compiled by the Tallahassee Police Department and provided to the American Civil Liberties Union.

That’s 40 or so instances a year in a city of 290,000, a surprisingly high rate given that the StingRay’s manufacturer, Harris Corp., has told the Federal Communications Commission that the device is used only in emergencies.

At least 48 state and local law enforcement agencies in 20 states and the District of Columbia have bought the devices, according to the ACLU.

The secrecy surrounding the device’s use has begun to prompt a backlash in cities across the country.

In Baltimore, a judge is pushing back against the refusal of police to answer questions while testifying. In Charlotte, North Carolina, following a newspaper investigation, the state’s attorney is reviewing whether prosecutors illegally withheld information about the device’s use from defendants.

In Tacoma, Washington, after a separate newspaper investigation found that judges in almost 200 cases had no idea they were issuing orders for the StingRay, the court set new rules requiring police to disclose the tool’s use. The state legislature is weighing a bill to regulate police use of the equipment.

The FBI and Tallahassee police say that the device is used only with an appropriate court order and that they do not collect call or text-message content. The FBI also said it retains only location data that is relevant to an investigation and immediately discards all other data.

So far, there is virtually no case law on how the Fourth Amendment — which prohibits unreasonable searches and seizures — should apply to this particular technology.

In November, after McKenzie’s original lawyer dropped out, his case was assigned to a public defender, Carrie McMullen.

Around that time, the lawyer for one of the co-defendants began to wonder: How did the police figure out that McKenzie was at 3197 Springhill Road that morning?

McMullen’s office hired a lawyer with technology expertise. John Sawicki, the expert, produced a map on which he plotted all the locations provided by Verizon, and they clumped in three different areas of town.

Cell-tower data can give general geographical areas where a phone was used, but “they will not tell you he’s in House X,” Sawicki said. “That’s how imprecise it is.”

In March, the defence team deposed police investigator Robert Newberry. The lawyers tried to get Newberry to explain how the police zeroed in on 3197 Springhill Road. He mentioned the cell-tower records, and then, under probing, acknowledged that they had not been sufficient on their own to locate the suspect.

He said that a “Sergeant Corbitt” in the Department’s Technical Operations Unit had identified the phone’s location. “He would have to tell you how he got to that,” Newberry said, referring to Christopher Corbitt, who handles electronic surveillance operations.

There were other questions about whether the police had reasonable suspicion to pull McKenzie over. The descriptions Williams gave of the suspects were vague and, in fact, none closely matched McKenzie’s actual appearance.

The descriptions fit “two-thirds of the young black males living on the south side of town,” Sawicki said.

Newberry could not fully explain how Corbitt determined the phone’s location. “I can’t address it because I don’t know the magic behind it,” he said.

In April, the defence team deposed Corbitt.

He told the attorneys that he turned up the address on Springhill by running phone numbers that the suspect’s phone had dialed through a subscription database, called Accurint, that helps law enforcement locate individuals through records such as phone numbers, property records and court records.

But how did he know the phone was in the house at 6 in the morning? The phone was a “burner” — one not registered under McKenzie’s name.

“We do have specific equipment that allows us to . . . direction find on the handset, if necessary,” Corbitt said.

“What is that, and how does that work?” McMullen asked.

“I can’t go into that,” he said. “Due to a nondisclosure agreement with the FBI, we’re not able to get into the details of how the equipment operates.”

He acknowledged the device was a cell-tower simulator.

He also acknowledged that the device, whose model name he could not give, was used to “assist in locating or determining the person in possession” of the cellphone, and that it could elicit signals from a target’s phone even when the phone was not in use.

“It is not nearly as invasive or as sinister as it is sometimes characterised to be,” he said.

“I so wish that I could tell you how this equipment operates, because I think I could put so many people at ease,” he said. “Unfortunately, I am not able to do that.”

He said that if the defence wanted more specific information, then he had “a specific protocol” to follow requiring him to notify the FBI and the Department of Justice.

The Tallahassee police declined to comment for this story.

In June, in response to a motion for public access by the ACLU, the state released a transcript from a closed court hearing in 2010 relating to a Tallahassee rape case in which Corbitt testified that he had used a cell-site simulator to identify a suspect in an apartment complex.

“In essence, we emulate a cell-phone tower,” he said. “We force that handset to register with us. We identify that we have the correct handset and then we’re able to — by just merely direction-finding on the signal emanating from that handset — we’re able to determine a location.”

He noted that the equipment “is evaluating all the handsets in the area”.

“Using portable equipment,” he said, “we were able to actually basically stand at every door and every window in that complex and determine, with relative certainty . . . the particular area of the apartment that that handset was emanating from.”

He said the Tallahassee police began using the device in the spring of 2007. From that point until August 2010, he said, the police had used it “200 or more times” to locate a cellphone.

How reliable was it? “Truthfully,” he said, “100 per cent.”

In September, McMullen drew up a motion to suppress the evidence obtained against McKenzie prior to his arrest, alleging that his Fourth Amendment rights were violated by the use of the StingRay. She argued that the police had not obtained a warrant based on probable cause to use the device.